Skip to content

Cookies keep you signed in. Accept also turns on Sentry session replay and tracing; Decline keeps them off. Cookie Policy · Privacy Policy

Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how XBio ("we", "us", "our") collects, uses, and protects your information when you use our service at xbio.gg.

1. Information We Collect

Account data: Name, email address, and profile picture (via OAuth providers or direct signup).

Profile content: Username, bio, links, theme configuration, and any media you upload.

Usage analytics: Page views, link clicks, referrer URLs, country, and device type, stored in our database and associated with the profile that was visited. Visitor IP addresses are not stored: the address is converted to an irreversible keyed hash the moment a request arrives, and only that hash is written. We use it solely to tell repeat visits apart - so a single visit isn't counted twice and XP can't be farmed - never to identify anyone. Note that a hash of this kind is still treated as personal data under the GDPR; what it prevents is anyone reading addresses out of our database.

Product analytics: To understand how people find and use XBio, we record two kinds of events in PostHog (see section 3). On XBio's own pages - the homepage, shop, editor and the like - we record anonymous page views, which links and buttons are clicked, where on the page clicks land and how far people scroll, and a few actions such as starting a signup. Clicks are not recorded on your account or referral pages. On creators' profile pages we record only the page view and how quickly the page loaded and responded - never what a visitor clicks. Every page and link address is stripped of everything except campaign tags before it is sent. And when you use your account, we record key actions against your account ID: signing up (with the campaign tags of the link that brought you to XBio, if it had any - see section 4), creating and saving a profile (with its link count), starting a checkout, completing a purchase, and connecting Discord. Those account events carry a random ID, never your name or email address.

Discord connection: If you connect Discord (or sign in with it), we store your Discord user ID and username, and use them to give you roles in the XBio community Discord server that match your plan - for example the Pro role while you subscribe. When you connect, Discord also gives us a temporary access token; we use it once, to read your username and, if you agreed to it, add you to the server, and then delete it. We do not keep it. Disconnecting Discord removes those roles and your stored username.

Payment data: Payment processing is handled by Stripe. We store a Stripe Customer ID but never see or store your raw card numbers.

Email subscribers: If you use the email capture feature on your profile, subscriber email addresses are stored in our database and are accessible only to you.

2. How We Use Your Information

  • Provide, operate, and improve the Service
  • Process payments and manage your subscription
  • Send transactional emails (verification, password reset, purchase receipts)
  • Send the welcome email on signup
  • Send a weekly email with your profile's views and clicks, which you can turn off from your account settings or the unsubscribe link in each one
  • Calculate profile analytics and XP for gamification
  • Understand which parts of the Service people use and where they get stuck, so we can improve it
  • Enforce our Terms of Service and prevent abuse
  • Detect, investigate and fix errors, crashes and security faults

3. Third-Party Services

We use the following third-party services that may process your data:

  • Neon (neon.tech) - Serverless PostgreSQL database provider. All user data is stored on Neon infrastructure.
  • Stripe (stripe.com) - Payment processing. Stripe's privacy policy governs payment data. We receive only a customer ID and payment status.
  • Resend (resend.com) - Transactional email delivery. Your email address is shared with Resend to deliver verification and notification emails.
  • Slack - We send ourselves internal notifications (via a Slack incoming webhook) when you sign up or make a purchase, which include your name and email address. These notifications go only to our private admin workspace - Slack does not otherwise process or store your account data.
  • Sentry (sentry.io) - Error monitoring, session replay and performance tracing, which we treat separately:
    • Error monitoring runs for all visitors, including those who decline the cookie banner. It captures browser type, the page URL and partial stack traces. It sets no cookies and uses no device storage. We rely on legitimate interest (Art. 6(1)(f) GDPR) in keeping the service working and secure. To minimize what is sent, IP address collection is disabled and every report is stripped of email addresses, access tokens and session cookies before it leaves our servers.
    • Session replay and performance tracing only run if you accept non-essential cookies. Replay records a playback of your session when an error occurs and uses your browser's session storage. Declining, or not choosing, keeps both off.
  • Vercel (vercel.com) - Hosting and deployment. Vercel Analytics collects aggregate page view statistics (page URL, referrer, country, browser, operating system and device type). It sets no cookies and uses no device storage, so it runs for all visitors: a visit is counted using a hash of the incoming request that Vercel discards after 24 hours, and no IP address is stored. We rely on legitimate interest (Art. 6(1)(f) GDPR) in understanding how the site is used.
  • PostHog (posthog.com) - Product analytics, hosted in PostHog's EU cloud (Frankfurt). It sets no cookies and uses no device storage, so it runs for all visitors: anonymous visitors are counted with a hash PostHog computes on its servers and rotates daily, so it cannot recognise you on a later day, and no IP address is stored. It also records how quickly each page loads and responds (Core Web Vitals). Account events are identified only by your random account ID. We rely on legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the Service; you can object at any time (section 8). PostHog keeps events for up to one year.
  • Google / GitHub / Discord OAuth - If you sign in via Google, GitHub or Discord, your name, email, and profile picture are provided to us by those services under their respective privacy policies.
  • Discord (discord.com) - If you connect Discord, we send Discord your Discord user ID to add you to the XBio community server and to add or remove your plan roles there. Discord learns which XBio plan role you hold; nothing else about your XBio account is shared.
  • Cloudflare Turnstile - Bot/spam protection on signup. Your IP address is sent to Cloudflare to verify you're human; no cookies or tracking scripts are used.
  • Vercel Blob Storage - Uploaded files (avatars, banners) are stored on Vercel's blob storage service.

4. Cookies

We set the following cookies:

  • xbio.session_token - Authentication session cookie. Required for login. Expires with your session or after 30 days.
  • Theme preference - Stores your light/dark mode preference. No expiry.
  • xbio.last_login_method - Records which sign-in option you last used (email, Google, GitHub or Discord) so the sign-in page can highlight it. Contains nothing else. Expires after 30 days.
  • xbio_utm - Set only when you arrive through a link carrying campaign tags (utm_source, utm_medium, utm_campaign), and holds only those tags - no identifier, so it is the same for everyone who followed that link. If you sign up, the tags are recorded with your signup event (above) so we can measure which channels bring new users, and the cookie is deleted. Not set if you are already signed in. Expires after 30 days. We rely on legitimate interest (Art. 6(1)(f) GDPR) in measuring where our audience comes from.
  • xbio_internal - Set only on browsers where an XBio staff account has signed in, so the team's own visits are left out of our analytics. Never set for anyone else, and holds no identifier. Expires after 1 year.

Third-party cookies may be set by Stripe.js when you make a purchase, and Sentry Session Replay uses session storage - but only if you accept non-essential cookies in the cookie banner; declining or not choosing keeps it off. You can change or withdraw that choice at any time from "Cookie settings" in the site footer or on the Cookie Policy page. Sentry error monitoring, Vercel Analytics and PostHog are not in this group: they use no cookies or device storage at all (see section 3). We do not use advertising cookies. For a full list, see our Cookie Policy.

5. Data Retention

We retain your account data for as long as your account is active. Analytics events (views, clicks) are retained for 90 days, after which they're automatically deleted - and they contain hashed visitor identifiers rather than IP addresses for that whole period. You can request deletion at any time. Product analytics events in PostHog are kept for up to one year; if you delete your account, the account ID they carry no longer links to you or to anything else we hold.

6. Email Lists You Collect

If you enable email capture, the subscribers who sign up on your profile are your contacts, not ours. For those addresses you are the data controller and we act as your processor: we store them, and we send on your behalf when you use blasts or drip campaigns.

That makes some obligations yours, not ours. You must have a lawful basis for contacting the people who subscribe, only send them what they signed up for, and comply with applicable anti-spam law (including GDPR and CAN-SPAM). Every email we send on your behalf carries an unsubscribe link, and unsubscribes are honoured automatically - you may not attempt to defeat or remove that. We may suspend sending for any account that generates significant spam complaints or bounce rates, because delivery for every other user on the platform depends on our sending reputation.

We do not market to your subscribers, sell them, or use them for any purpose other than delivering the messages you send.

7. Outbound Webhooks

Pro users can configure webhooks that send events from their profile - profile views, link clicks, new subscribers, and milestones - to a URL of their choosing. Where you set one up, that data leaves our systems and is transmitted to a third-party endpoint you control and are responsible for. Depending on the event, the payload can include a subscriber's email address and coarse visitor information. We do not control what the receiving service does with it, so only point a webhook at somewhere you trust and are entitled to send that data.

8. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access - Request a copy of the personal data we hold about you
  • Portability - Receive your data in a structured, machine-readable format
  • Erasure - Request deletion of your account and all associated data
  • Rectification - Correct inaccurate personal data
  • Objection - Object to processing of your personal data, including the error monitoring and product analytics we carry out under legitimate interest (section 3)

To exercise these rights, email privacy@xbio.gg with subject "Data Request".

9. Data Security

We implement appropriate technical measures including HTTPS encryption, hashed passwords, and database access controls. No method of transmission is 100% secure; use the Service at your own risk.

10. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have, contact us immediately.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or a notice on the Service. Continued use after changes constitutes acceptance.

12. Contact

Questions about this policy? Contact us at privacy@xbio.gg or visit our Contact page.